Looking for a Firewall rule for Wrike

Hello John Skadowski1,

Thank you for reaching out to the community, you can also add the domains into the exception list:
Exceptions: https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Web/Exceptions/index.html

List. copy paste under the URL pattern matches one by one !!
^([A-Za-z0-9.-]*\.)?www\.wrike\.com/
^([A-Za-z0-9.-]*\.)?app-us2\.wrike\.com/
^([A-Za-z0-9.-]*\.)?app-eu\.wrike\.com/
^([A-Za-z0-9.-]*\.)?wrike\.com/
^([A-Za-z0-9.-]*\.)?d3tvpxjako9ywy\.cloudfront\.net/
^([A-Za-z0-9.-]*\.)?d1c5qktmphn2d\.cloudfront\.net/
^([A-Za-z0-9.-]*\.)?dm0wghfwpe2fj\.cloudfront\.net/
^([A-Za-z0-9.-]*\.)?d10b6odojqpx09\.cloudfront\.net/
^([A-Za-z0-9.-]*\.)?st\.wrike\.com/
^([A-Za-z0-9.-]*\.)?sst\.wrike\.com/

Hi Vivek,

Thank you for the quick response.  I have these in the Web Exceptions already too.  

The upload issue for Wrike is that they use AWS for their storage.  If you look closer in the browser code and the transactions you can see that Wrike/AWS embeds a VPN proxy for the file transfer process.  Somehting the Wrike whitelist does not show or suggest to allow for application bypass. I have turned off App and IPS controls on the firewall rule to be safe, but still the issue remains.

Further thoughts?

Does it work fine in a plain FW rule ? Please try testing with a single source cline machine, and with 'none' option selected for web, app, ips and no scanning applied just plain LAN to WAN with one source IP and destination 'any' and service 'any.' 

It does not.  I had started testing with a rule as you suggested about 4 weeks ago for 3 users.  They have been in this rule since then.  I had tested adding Allow All for App and IPS to be able to see any activity, but have changed those back to None.

No dice

...

It does not.  I had started testing with a rule as you suggested about 4 weeks ago for 3 users.  They have been in this rule since then.  I had tested adding Allow All for App and IPS to be able to see any activity, but have changed those back to None.

No dice

...

I doubt then if it is really an issue from the XG appliance, if you have multiple ISPs configured, have you tried diverting the traffic from the other ISP ? 

Just one ISP/DIA in Wan Zone.  We have a private ENS circuit that is 10.x.x.x traffic.  The ENS would be my failover circuit if the DIA went down.

Actually happeing with muyltiple sites where XG is deployed.  One 100Mb burstable, one site 1Gb, the other is 500Mb.  No line is ever saturated.

You can Create and download a packet capture : https://support.sophos.com/support/s/article/KB-000037007?language=en_US
then can analyze with the help of wireshark whether the appliance or ISP is the culprit here !!

Hi Vivek,

Thank you I will run a packet capture or two and try to recreate the issue.  We use Vlans on Port 1 (LAN) and KB states to use the sophos firewall ip.  I will assume to use Port 2 (WAN) ip address for the packet capture if analyzing the ISP and then analyze.